« first day (599 days earlier)      last day (4346 days later) » 

9:01 PM
"It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases."
lol
 
@webarto Is that a good thing? :P
 
salting is "enhanced security" now? It should have been there from day 1
 
cch
Hello!
 
@rdlowrey I think I might get time to work on HTTP stuff with you tonight. Will you be available?
 
Security is like lifeboats. You don't notice them, or even think they just get in the way, until you need them and realise you don't have enough.
 
9:03 PM
@GordonM hey dawg, your code looks like Titanic :P
 
> For security reasons, you should never change your password on any website by following a link in an email.
not precisely true
 
@webarto I'll never let go, Jack. lets go
 
user895378
@LeviMorrison Yes. I'm going to stop working right now so I'll be back and working by about 9 EDT / 7MDT.
 
@Truth if you take out Flash code out of the equation, it's good :P (animations etc)
 
@ircmaxell well, it's not like that idea will generally hurt the user
 
user895378
9:03 PM
@LeviMorrison Any time after that I'll be around
 
@rdlowrey Sounds good. I should be here.
 
user895378
cool.
 
@orourkek as part of a syn-ack system, it can be very secure to follow a link in an email to complete a password reset
 
can be
 
Updated linkedin password. For all the good it will do. :P
 
9:06 PM
definition of lazy: SSHing to computer few feets away, from bed.
 
> LinkedIn passwords are encrypted using an algorithm known as SHA-1, which is considered very secure. Complex passwords will likely take some time to decrypt, but simple ones may be at risk.
 
lol which is considered very secure
 
wait, they're not even salted?
 
as i understand it : no, they are not
@webarto , maybe "pepper" was included
 
9:13 PM
legacy code, technical debt, Java(?), how to call it?
yeah, I hear pepper is the new salt :P
I hacked into company intranet, and guy who code it told me... yeah, I haven't had enough time to hash + salt password, and I left them plain... I was like, I don't want to work here anymore.
 
Yay, tan guy's back
 
yay
let's all change avatar to @rdlowrey and rename room to "tan room"
 
compare that CNET article to : shiflett.org/blog/2012/jun/leakedin
 
@rdlowrey I went to "sun bathing machine" today for 10 mins, hope you're proud of me
 
@tereško LinkedIn salting passwords is considered "Enhanced Security", and from what I can tell was just implemented today :P
 
9:17 PM
not salting, hashing
 
Hmm
 
i don't want to live on this planet anymore
 
I was thinking that PHP md5() and sha1() should emit an E_NOTICE when used. But of course they're okay for non-cryptographic use so that's probably not such a good idea after all.
 
Register leakd.in

1
1 Year
$2.48
Domain name servers updated!
now we wait
 
> We take the security of our members very seriously.
fuxk you idiot
 
9:27 PM
php -r 'echo sha1("We have no idea what we are DOING!") . "\n";'
 
 php -r 'echo sha1('123456' + uniqid()); # uber security'
 
leakedin.org is getting hammered now.
And what's all this talk of rainbow tables? You don't need rainbow tables anymore. Just access to a sufficiently meaty GPU
 
@GordonM stupid people are stupid
 
I have access to those mofo GPU's... what are those brute force programs called...
 
9:37 PM
ah, right, that's the one, thanks
how I choose what graphic card to buy :P n1cgi.distributed.net/speed/…
 
2300M/s SHA1 hashes on even a relatively out of date ATI GPU? And if linkedin is anything to go by then password hashing is probably rife with MD5 and SHA-1 hashing
 
@GordonM Rainbow table all the way. I'm lazy :D
 
@Truth Looks like GPU is for the epicly lazy if those performance figures are accurate.
 
@GordonM That program is outdates, I don't think it would work well with newer GPUs, but you can always try.
 
wondering how long does it take to crack with those 3.5 billion per second GPU's...
 
9:47 PM
@Truth There's probably something newer and better out there. And if it works with GPUs from 2 years ago then that's not a problem, you can pick those up dirt cheap now.
 
@orourkek The way this is written, it's very cautious, and no information next to that what is already known publicly is added.
 
I guess so, but 5.6G hashes/sec?
Damn
I could crack the entire database in a few days
 
@hakre the classic PR blog post :P
 
That's why SHA1 is no longer considered secure :)
 
@orourkek Actually I'd say even there is PR speak, by the level of information this is a very bad sign.
 
9:48 PM
@GordonM Even with SHA1, if you iterate over itself 10k times, it's secure enough for me
Even though bcrypt is usually a better option
 
The PHP example for the factory pattern on wikipedia is surprisingly good: en.wikipedia.org/wiki/Factory_method_pattern#PHP
I expected a singleton or something lol
 
Well, they left that part out, because actually in PHP you don't need singletons.
But psst, that information is a secret hack0r developer trick
 
you're right, never thought I would be reading PHP code on wikipedia, probably some wikipedia engineer added that :P
 
We should edit the wikipedia article so it stays secret
 
Deffo need to find some good blowfish tutorials.
But some other time. Night!
 
9:51 PM
gn8
 
@webarto Simply beautiful, I love the typography you used. Stunning.
 
so retro
 
lol
 
@LeviMorrison , only .. well .. i would consider it to be an antipattern to begin with
 
9:59 PM
@tereško Well, I think the factory class does have a great use: meshing good, solid code with old, legacy code. I haven't used the factory class in another situation before, so I'm not sure if the other uses are anti-patterns. I can't really say.
 
Unfortunately, it isn't a use mentioned on the wikipedia article.
 
E_USER_CANNOT_READ
@LeviMorrison , please , stop confusing factory class with factory method
 
@tereško Educate me on the difference, please. Factory ___ is not something I'm very accustomed to, as you can tell.
 
when factory method pattern is used, you have a static method within the class building instance of itself
 
10:05 PM
where are they learning this :(
$ID = $_POST['ID'];
$Player = $_POST['Player'];
 
not sure
 
@webarto God! Capitalized variable names!
(:P)
 
@NikiC , look at the close-vote link
 
@NikiC that aside :P simple extract($_POST) would do, if necessary...
 
Register globals turned off? extract($_REQUEST) to the rescue ;)
LOL
 
10:09 PM
@hakre It's actually surprising how common this is
 
@webarto , i crown thee the worst advisor of the day
 
$_REQUEST (almost equal) CSRF :P
 
@NikiC Scary somehow.
 
@hakre There are a lot of scary things...
 
@tereško nah, I don't care, it's just, how they can't figure out that code doesn't make sense...
 
10:11 PM
@LeviMorrison , the factor class ( abstract factory pattern ) instead makes you have a completely separate class , from which you create an instance. This object ( which can be injected ) then can create instances of different classes
 
@NikiC Yeah, I quit PHP now. It's too scary.
 
dear adobe (and products), everytime you crash my hate for you goes over 9000
 
But actually, the truth is, PHP stopped working on my computer upgrading from PHP 5.3 to PHP 5.4
 
@hakre óÒ
 
@tereško And that's different from the factory method how? You didn't say.
 
10:13 PM
I thought PHP works everywhere
Even my toaster can run PHP!
 
@CarrieKendall :D how much is 9000 in your numbers?
 
@CarrieKendall , buy the new bug fix version , that will fix it
8 mins ago, by tereško
when factory method pattern is used, you have a static method within the class building instance of itself
 
@tereško if only they would fix bugs in new versions
 
@tereško I missed that somehow. Thank you.
 
@NikiC Well actually it's okay. Fedora updated it for me and I need to take care of the config files and need to learn how yum handles this.
 
10:14 PM
@RepWhoringPeeHaa they don't fix bugs, they add some, you know the nice once with the fancy suits
 
@markustharkun 9000 is almost over 9000 in my numbers
 
It creates some .rpmnew file which I think I should merge first
 
@RepWhoringPeeHaa , well , they fix some .. not like a single version have all the bugs fixed
 
@CarrieKendall wow, that's a lot
 
also you have to add some new .. job security and all
 
10:16 PM
 
psds arent compatible with adobe acrobat pro.. MAKES SENSE
 
is there something like winmerge but for linux?
 
depends
 
kmerge or so?
 
what does winmerge do on windows ?
 
10:21 PM
@hakre diff?
 
actually winmerge does windiff
 
no it was winmerge - winmerge.org - lol
@RepWhoringPeeHaa me want gui.
but me can use phpstorm as well
 
@hakre pussy ;)
 
meouw
 
10:23 PM
# yum install kompare works - thx @tereško !
 
:), true. but it's also good to get feedback from potential users.
 
Hey
How's it going?
 
what do you need
 
wow, safemode has been removed in php 5.4. Now that's a nice thing.
 
10:32 PM
PHP 5.2.14 (cli) (built: Dec 31 2010 08:08:29) :(
 
If anyone wants to melt their brain a little, I could use a hand on this:
1
Q: Finding open contiguous blocks of time for every day of a month, fast

ChrisI am working on a booking availability system for a group of several venues, and am having a hard time generating the availability of time blocks for days in a given month. Given a venue_id, month, and year (6/2012 for example), I have a list of all events occurring in that range at that venue, ...

 
could you post table dump please
@Chris
 
Table dump?
I don't see how the table structure relates to the problem at hand -- I am looking for a solution that addresses the concept without regard to my data source.
 
mysqldump -p - -user=username dbname tableName > tableName.sql
 
I know what a table dump is
:p
 
10:46 PM
pussy imports /etc as PHPStorm project to get better merge tool with editing capabilities
 
ok :P just thought it would be easier for someone to test code on actual data, that's all...
 
@webarto There's over 20,000 rows
Heh
I could make a sampling
 
yeah just a few of them, but if it's an overkill, don't... someone will probably answer sooner...
 
@Chris is the 15 minute interval because the available start times for an event are *:00, *:15, and *:30?
and *:45, d'oh
 
@hakre GUI wins
 
10:52 PM
@orourkek Ya
 
I have half of an idea, though I can't connect the dots to see if it's worthwhile
Instead of using clunky timestamps in those loops, why not "bitmap" the day based on 15min intervals? Each day would have a binary flag for each 15 minute block to signify availability
Though my picture of the project as a whole might not be totally accurate
 
looping in general would be slower than some mofo SQL query if possible
 
@hakre :)
 
@orourkek I used range to make an array out of the 15 minute segments for the day, which I thought of as sort of a "bitmap". Then I want to toggle bits by placing other similar maps against the main one, but I am not finding a better way than to loop. I was fooling around with array_diff and the like, but those eliminate the bits rather than toggle them -- then I can't find my continuity, I just have a pile of bits that shouldn't may or may not belong adjacent to one another
 
11:01 PM
@Chris Will you be working with the data one day at a time, or more?
What I mean is will you need to populate something like a full month-long calendar with available times, or will someone be searching for a specific day?
 
it's easy to run something fast ~30 times
 
@orourkek Full month calendar. As the user changes months, the availability for any newly encountered month is requested AJAX before the calendar gets drawn, that's why I was concerned with speed
 
oh wow, if I were a new user on this site I would double-cross my fingers to not get my question linked here ;)
 
If they're new, they probably don't know "here" exists :p
 
@Chris Then this is definitely a place for a cache file with data arrays
 
11:05 PM
Ignorance is bliss, in that case, hehe
 
after doing a comment and telling the new user what's the problem, you need to give some time to the user that she/he can edit it.
if there is no reaction however, keep on going ;)
 
@Chris If the data is volatile, then perhaps another more specific (to the by-month availability) database table should be used, but my gut says to cache the months into separate files, perhaps JSON.
 
I do have quite a bit of resource at my disposal, so caching to file (or even to db) isn't out of the question
The data can be volatile, then enter long idle periods
 
okay folks
I wish you all a good night
 
It wouldn't be too hard to update the cache every time an event gets added/updated, but redundancy would definitely be a good idea
 
11:08 PM
But never more than a week, average
 
(in some form, anyways)
 
merging config files get one tired
 
@hakre bye
 
later @hakre
 
Good evening
 
11:09 PM
the new gnome is cool as the extensions now work better ;)
 
Unit tests make my life happier and easier.
 
<--- never done unit test
 
Quitting time... thanks for the chat @orourkek -- if I don't think of or have suggested something better, I can always keep my existing method and cache it
 
or dump sql tables
 
np, I'm a big fan of caching massive data like that :]
 
11:14 PM
@webarto I don't always unit test, but when I do, I'm usually very drunk
 
test drunk, fix sober
 
I put a dump of event times on that question, I'll add the other tables when I get home... really wanna get the hell out of this place
Later
 
@Chris bye
 
@rdlowrey I may wind up using your ReflectionCache...Was having a dilemma with some ways I was needing to use Reflection and this may solve some of my issues
 
11:25 PM
"ReflCacher" :)
 
@NikiC Yea, obviously both. But I'm probably gonna use his implementation too
 
@webarto where's your link to the duplicate?
 
not a real question
 
@webarto not a real answer
 
I haven't downvoted so I don't care, but let's wait and see if there would be some wise TL;DR answer or jfGit answer
leakedin.org <- social engineering anyone?
 
11:37 PM
@rdlowrey , what the hell is getCtorParams() ?
@webarto , noone with half a brain would write his/her password there
 
@CharlesSprayberry I was more referring to the name ^^
It sounds a bit like someone went out of characters when writing it ^^
 
@tereško got an idea for leakd.in :P
 
now thats just being nasty
 
then again, do what thou wilt
 
11:41 PM
@NikiC Yea, since it is under MIT license I might do some modifications on it before I use it
 
Hi guys. Please look at this question if you familiar with Facebook Graph API stackoverflow.com/questions/10923783/…
0
Q: Facebook Graph API session expiration

user1272724I use the following PHP code to publish random messages from my database to my Facebook fan page: require_once('src/facebook.php'); $appid = 'MY_APP_ID'; $appsecret = 'APP_SECRET'; $pageid = 'MY_PAGE_ID'; $token = 'MY_ACCESS_TOKEN'; // Create our Application instance (replace this with your app...

 
@ircmaxell Thanks for reading my mail :)
I always fear that if it's too long people don't read it ^^
(Like I do :P)
 
I love the concept
 
11:56 PM
@ircmaxell already tagged :P @tereško no, jk
 
I know
:-P
 

« first day (599 days earlier)      last day (4346 days later) »